req.session in express-session not persisting

Change cookie: { secure: true }to cookie: { secure: false }

using secure flag means that the cookie will be set on Https only.